Vietnam’s Cybersecurity Draft Law: Made in China?

Vietnam’s Cybersecurity Draft Law: Made in China?

During the first part of last year’s November, the National Assembly of China passed the Law on Cybersecurity and established its effective date to be June 1, 2017.

Then come June 2017, five days after said law went into effect in China, the Vietnam’s Ministry of Public Security (MPS) sent their own proposal regarding a draft of the Cybersecurity Law to the Vietnamese government. It has been claimed that this draft law was the result of a legislative process which began to take place since July 2016, when the National Assembly scheduled Cybersecurity Law as one of its agenda’s items then. The MPS then also established their own drafting team and an editing group to work on the drafts of Vietnam’s Cybersecurity Law in late March this year.

After going through various collections of public comments and four draft versions of the law, the final draft (Draft Law) now is in the hands of the National Assemblymen and women. It would be among the items to be discussed when they meet at the end of 2017, and if all things go according to plan, Vietnam’s Cybersecurity Law will get approved and signed into laws by the middle of next year.

Yet, whether purposefully or unintentionally, Vietnam’s Draft Law has shocked many people because it is almost identical to that of China’s.

In their proposal submitted to the government, the MPS stressed that they have researched, and thus taken into considerations Cybersecurity laws from China, Japan, the Czech Republic, South Korea, and the U.S when drafting the Draft Law.

I have to make it clear that I do not have any evidence to conclude the Vietnamese government has indeed copied China’s Cybersecurity Law. Moreover, if both countries are functioning under an identical political system, then the use of identical legislative tools would be very understandable. This is even more likely when the MPS openly admitted that they have considered Chinese laws as stated. Besides, copying or learning from other countries’ legislative experiences do not necessarily mean negative consequences.

However, let’s just go straight to comparing Vietnam’s 4th draft of the Cybersecurity Law currently sitting on the desks of the National Assembly’s members and the English translation of the Chinese laws, to see how much they are alike to one another, and whether such similarities will bring negative consequences to Vietnamese people.

1. Two documents, one technical term

There is one technical term in the Vietnamese Draft Law that one should pay close attention to, which is the “critical information system regarding national security” in Article 9.

In the China’s version, there is a similar technical term: “critical information infrastructure” in Article 31.

Both laws centered on these two technical terms, and their definitions are also very much alike. Both are used to define any information, that if being under attack, they would bring harms to national security, social order and public safety.

That information – as mentioned in both Vietnam’s and China’s Cybersecurity Law – would then include energy, finance, transportation, media, and publications, as well as electronic governance.

However, the Draft Law of Vietnam also includes military-security, national secrets, banking, natural resources and environment, chemicals, medicine, and other national security structures.

The Draft Law also does not distinguish between private companies and government agencies when applying the concept of “critical information system regarding national security”. Based on the context of said law’s wordings, the targeted entities are implied to be both of them. The government and the enforcing authorities could also interpret this law as broad as possible.

Baker & McKenzie, in their analysis of the Chinese Cybersecurity Law, has warned all companies whose may have established relationships with those entities which fall under the regulatory perimeters of said law, that this law could very well be applicable to them.

The agencies and enterprises who are within the application of this law shall abide the technical measures and regulations as set by the government, and submit themselves to be under the direct control and observation of the MPS. They will have to obtain all necessary business permits to operate and maintain their equipment while at the same time, must cooperate with the authorities in monitoring users’ information.

These regulations between Vietnam and China are identical.

2. Directly target information considered to be dangerous to the regime

It is not surprising to learn that both Vietnam and China are extremely concerned about cybersecurity.

As detailed in the proposal from the MPS, the Draft Law of Vietnam focuses on underlining the importance of “preventing, fighting against, and neutralizing all activities using cyberspace to intrude national security; subverting against the Socialist Republic of Vietnam; propagandizing to destroy the ideology, the internal affairs, and the common national unification; inciting mass protests; and obstructing cybersecurity, from the reactionary forces and those who are enemies of the State”.

Further, Article 22 of the Draft Law clearly states that the Vietnamese government would apply all necessary technical methods to treat such information.

Article 12 of the Chinese Cybersecurity Law has a similar provision when it prohibits Internet users from using “the network to engage in activities endangering national security, national honor, and interests, inciting subversion of national sovereignty, the overturn of the socialist system, inciting separatism, undermining national unity, advocating terrorism or extremism, inciting ethnic hatred and ethnic discrimination, disseminating violent, obscene or sexual information, creating or disseminating false information to disrupt the economic or social order, as well as infringing on the reputation, privacy, intellectual property or other lawful rights and interests of others, and other such acts”.

3. Requiring all Internet users to provide true identity

Article 47 of the Vietnamese Draft Law specifically demands all Internet service providers to require “users to provide true and correct personal information. If any user refuses to comply, the service providers shall have the responsibility to deny that user service”.

At the same time, Internet service providers must establish their own verification system to ensure the accuracy and veracity of the information provided by the service users according to Article 33.

Article 24 of the Chinese Cybersecurity Law has the same language as those contained in the Vietnamese Draft Law’s Article 47.

Once businesses and the State can obtain users’ detailed personal information, there will be no guaranty that they would not use it for improper purposes, and would not harm such users.

4. The server is required to be localized within Vietnam’s territory and the providers will have to transmit their data overseas

This requirement has proven to be the most controversial in the past few days among the public in Vietnam.

Article 34 of the Draft Law requires “foreign corporations and providers, in order to provide telecommunications and Internet services in Vietnam, must … obtain business permits to operate, maintain a local representative agency, and the server which manages Vietnamese users’ data shall be stored within the national territory of the Socialist Republic of Vietnam”.

Article 48 further provides, all personal information and important data concerning national security shall be stored within the national territory of Vietnam. In the event that someone wants to transfer such information overseas, then a security assessment shall be performed according to the related governmental agencies’ requirements.

These rules and regulations have caused many Vietnamese concerns, that Google, Facebook, other social media platforms, email providers, and cloud computing service providers will soon pack up and leave Vietnam’s market.

Surprisingly, Article 37 of the Chinese version also provides for similar regulations as the two above-mentioned Draft Law’s articles.

As recent as this past June, tech giant Apple had to cooperate with a Chinese corporation to invest in a database center to comply with this specific provision. Microsoft, IBM, and Amazon had complied as well.

5. Forcing users and providers to act as informants

If the Draft Law gets passed into law, Internet users, telecom and Internet providers must cooperate thoroughly with the government.

Article 45 requires those who engage in activities using cyberspace must strictly comply with the government’s guidelines and shall allow the government to enforce their cybersecurity’s measures and safeguards.

Moreover, all service providers must work with the government to provide actual identities of those Internet users, while at the same time, shall have the responsibility to fend off all information which is deemed to be detrimental to the State, according to Articles 46 and 47.

Again, we find the same regulating language in China’s Cybersecurity Law. This time is located at Article 28, which demands that “network operators shall provide technical support and assistance to public security organs’ and state security organs; lawful activities preserving national security and investigating crimes”.

6. Forcing tech companies to follow government’s technical standards

Article 46 mandates all businesses involved in the production and putting in commerce digital products, as well as providing Internet services, shall be in accordance with the provisions of laws and with the “mandatory quality assurance of State standards”, before releasing their products to the market.

The State also shall pass laws which set the standards for the hardware and software to be used with the above-mentioned technical measures, as well as make sure that the applicable entities shall comply.

This provision also serves as the legal basis for the State to enact the necessary decrees and orders, regulating the specificity of the technical measures mentioned and how to enforce such measures.

Compare to China, the Chinese government had required all new computers to be pre-installed with the automatic content-control software – Green Dam – and also forced businesses, including Google, to have this software installed on all their computers.

The fact that the Vietnamese government had become increasingly more and more interfering with the technical measures regarding the high-tech market highlights the fact that it has opened the doors for corruption and abuse of power from the MPS, the Ministry of Defense (MOD), Ministry of Science and Technology, and other related governmental agencies.

7. Forcing all entities that have relations with “critical information” to be evaluated by the State when buying hardware and software.

Articles 11, 16, and 48 of the Draft Law gives the MPS, the MOD, and other State’s agencies, the authority to review equipment, networks products, and services which may be related to the national critical data system before they could be put into use or upgrade.

This is similar to Article 35 of China’s Cybersecurity Law.

Accordingly, this regulation means that any governmental agency or private business – who maintains an information system which related to energy, national finance, banking, transportation, chemicals, medicine, natural resources and environment, media, news and publishing, shall go through the MPS and/or the MOD when purchasing the necessary hardware, software, Internet service provider for their operation.

It probably makes sense to see this regulation being applied to government’s agencies, but the fact that it is stepping into fields such as banking, medicine, news, and publishing, raises questions about the State’s ambition in controlling information in society at large.

These regulations would grant the police and military the all-access key to both government’s agencies’ and private businesses’ hardware and software. This would be an opportunity for them to exert pressure on other agencies, businesses, as well as putting the whole society at risk for corruption and abuse of power.

—

The above were only seven strikingly obvious similarities between the Vietnam’s Draft Law and China’s Cybersecurity Law. With an in-depth reading of both documents, one probably finds, even though smaller, much more alike features.

Self Immolation in Vietnam: A Victim of Injustice’s Agonizing Act In Defiance

In the afternoon of July 2, 2018, a man committed self-immolation in the center of Hanoi, Vietnam’s capital city, a few steps away from the Central Citizen Reception Committee’s office on Ngô Thì Nhậm Street.

He was later identified as 58-year-old Bùi Hữu Tuân, former village chief of Đạo Ngạn Village, Hợp Đồng Ward, Chương Mỹ District, Hanoi.

The victim is now in critical conditions with severe burns to the whole body.

Mr. Tuân was charged with Article 356 of Vietnam’s Penal Code for “abusing official position, power in the performance of official duties.”

He was supposed to begin his sentence of 3-year-imprisonment today, July 3, 2018. In the last act of defiance, one day before its commencement, he desperately protested the injustice of the trial and his conviction.

He was charged, tried, and convicted with not only insufficient evidence, but the evidence at trial showed that the prosecution did not even have any evidence for one element of the crime they had charged him with.

His son told VOA Vietnamese in an interview on July 2, 2018, that after Tuân failed to get the Central Citizen Reception Committee’s office agreed to halt his sentencing while reviewing his complaint to the Government Inspectorate, he went outside and committed the self-immolation.

Article 356 prescribes: “Any person who, for personal gain or other self-seeking purposes, abuses his/her power or position in performance of official duties to act against his/her official duties and as a result causes property damage of from VND 10,000,000 to under VND 200,000,000 or infringes upon state interests, lawful rights and interests of another organization or individual shall face a penalty of up to 03 years’ community sentence or 01 – 05 years’ imprisonment.”

From Pháp luật Thành phố Hồ Chí Minh (The Law – Hochiminh City) newspaper, the most damning evidence against Tuân was that he – as the village chief – allegedly accepted money, along with the requests of some 23 families in the village, to ask the local government to give them lands to build their ancestors’ shrines and worship places. Yet, none of this money went to Tuân or any of his two co-defendants, as it was donated to the village.

The local procuracy’s office (the prosecution in Vietnam) and the court further alleged that he had overstepped his authorities in giving out land slots to the villagers, and thus had committed a crime under the above penal code.

According to them, he had abused his “official duties” even though some people questioned whether the village chief position could be considered an “office”.

At the trial court level, Tuân was convicted and sentenced to the maximum term prescribed by law: 5-year-imprisonment. The appeal trial upheld his conviction but reduced the sentence to 3 years.

The appellate court’s decision in upholding his conviction with actual imprisonment was the last straw for Bùi Hữu Tuân, and he committed the unimaginable act of setting himself on fire.

From a legal standpoint, Tuân was correct in protesting his conviction and his sentence because the first element of the crime “abusing official position, power in the performance of official duties” seemed to have been conveniently ignored throughout his criminal proceedings.

In the same article published back in November 2017, Pháp Luật newspaper reported that it was established at trial that all of the money which Tuân and his co-defendants received from the villagers, was donated to various community services projects in the village.

Neither Tuân or any of his co-defendants had used any portion of the money for personal gains.

In other words, it is almost certain that the prosecution would not be able to prove the first element of the crime alleged against him, that he did commit an act for personal gain or other self-seeking purposes.

Worse, the evidence further showed that Tuân did submit the villagers’ requests to the ward’s officials, asking them to give out the land to people for burial and worship purposes. Pháp Luật newspaper also wrote, back in November 2017, that they had interviewed the villagers independently and were told that the local officials were present, at all times, to survey the land with the defendants.

And while Tuân and two of his deputy chiefs were tried and convicted, none of the ward’s officials had to face criminal charges even though the same evidence could be used against them.

By the same token, it could be argued that if the evidence were not enough to file charges against the local officials, then it certainly would not be enough to convict Tuân and the co-defendants.

Undeniably, Tuân’s trial and conviction again delineate the inefficient and broken legal system in Vietnam where people can be charged, tried, and convicted with no evidence to prove the required elements of the crime.

“Minds” over Facebook: Vietnamese Netizens’ Great Cyber Exodus?

In the past two days, the “F-Generation” of Vietnam started what seems to be an online exodus when many well-known Facebookers announced that they are moving on to Minds.com – an alternate platform for social media.

The “F” in F-Generation stands for “Facebook” as the online social media giant has a dominant presence in the country where some statistics raised the number of users to be between 50 to 60 million.

For about two months, people had been protesting both online and offline against the latest Cybersecurity law which was passed by an overwhelming 86.86% of the National Assembly.

The law raised concerns over Internet users’ privacy, people’s freedom of expression, and their right to access the Internet.

Brad Adams, Asia director at Human Rights Watch, declared: “This bill, which squarely targets free expression and access to information, will provide yet one more weapon for the government against dissenting voices. It is no coincidence that it was drafted by the country’s Ministry of Public Security, notorious for human rights violations.”

In less than two days, some of the prominent Facebookers have received thousands of subscribers over at their freshly minted Minds accounts.

In the same time, reports of pages and personal accounts have been taken down by Facebook also surfaced.

Trương Thị Hà, a victim of police brutality during the last “Black Sundays” protest, announced on Minds this morning that her account has been deactivated by Facebook.

After she posted a letter to her university professor, asking him to explain why he stood there while the police brutalized her during her detention after the protest, that very post was deleted for “violating Facebook community standards” at about 8:30 a.m. Then, her entire account seemed to have disappeared by 10:40 a.m.

According to author Claire Bernish who wrote about Minds back in June 2015, Facebook could finally meet its match. Minds gives users the familiarity with many features they have already accustomed to on Facebook while commits to protecting their privacy.

“Minds takes the government’s eyes out of the equation by encrypting private messages and using open-source code that any programmer can check,” Bernish explained.

“We are a free and open-source platform to launch your digital brand, social network, and mobile app. We are also a social network ourselves. It is a global social network of social networks,” the Minds team declared.

The hacker collective Anonymous also backed Minds, citing the fact that the founders of the new online social media shared the same vision of those who use the Internet for activism.

According to the Wired UK: “Two of those on the Minds team – Bill Ottman and Lori Fena – have strong backgrounds dealing with privacy and freedom of expression issues and are both known for their internet-related activism. It is likely these are the type of people that the company is hoping to attract – those with a cause, who want to build something and share it openly with others who may also have a cause.”

President Trần Đại Quang signed the Cybersecurity bill into law on June 25, 2018, although some 27,000.00 signatures of citizens who had expressed their objection to the proposal of the law, were delivered to his office during the prior weekend.

It seems as if the activists and human rights defenders from Vietnam might have found a friend in Minds because the reason they chose Facebook in the first place, was to use the platform as a tool to advance a cause: promoting human rights and democracy in the country.

While not all of them agreed to the solution of leaving Facebook and saw that as a sign of defeat, the silence from Facebook during the last two months as the Cybersecurity law stormed the nation could force many activists to reconsider whether to continue to use it as their primary platform. Most are still using both platforms, but all seemed to agree that if Facebook agreed to comply with the new Cybersecurity, then it could mean they will have to leave for good.

Vietnamese netizens are no strangers to such online “resettlement.” Back in 2009, when Yahoo 360 blog closed down its operation, Facebook quickly became the next best choice in the country.

Almost ten years later, while Facebook could still enjoy its reign in the country as the most used online social media platform, the power of Vietnamese users should not be underestimated by anyone.

Afterall, Vietnamese are a group of people whose contemporary history entwined with mass migration and exodus. They have a lot of experience with starting over, yet again, and they will not be afraid to do so.

Civilians, victims of police brutality and arbitrary detention, academics, activists, researchers, and a lot more people from all walks of life inside and outside of Vietnam got together and produced a report on the two “Black Sundays” of June 10 and June 17, 2018.

It is the Vietnamese people’s unified and firm response to the vicious repression by the government during the latest rounds of protest in the country.

According to the Facebook page of Nhật Ký Biểu Tình (Protestors’ Diary), copies of the report have been delivered to the UN OHCHR, other international NGOs working on human rights as well as various foreign embassies.